78 行
2.7 KiB
JavaScript
78 行
2.7 KiB
JavaScript
const path = require("node:path");
|
|
const { pathToFileURL } = require("node:url");
|
|
|
|
const ROOT_DIR = path.resolve(__dirname, "../../../..");
|
|
let scanner;
|
|
|
|
describe("current fact-source sensitive content gate", () => {
|
|
beforeAll(async () => {
|
|
const scriptPath = path.join(ROOT_DIR, "scripts/qa/check-sensitive-content.mjs");
|
|
scanner = await import(pathToFileURL(scriptPath).href);
|
|
});
|
|
|
|
it("reports only redacted metadata for secret, account, path and infrastructure matches", () => {
|
|
const source = [
|
|
"SERVICE_PASSWORD=do-not-disclose-value",
|
|
"[email protected]",
|
|
"phone=13800000000",
|
|
"workspace=/home/developer/private/project",
|
|
"server=203.0.113.10",
|
|
].join("\n");
|
|
|
|
const findings = scanner.scanSensitiveText(source, "fixture.md");
|
|
|
|
expect(findings.map((item) => item.category)).toEqual(expect.arrayContaining([
|
|
"assigned_secret",
|
|
"email_account",
|
|
"phone_account",
|
|
"personal_workspace_path",
|
|
"public_ipv4",
|
|
]));
|
|
expect(JSON.stringify(findings)).not.toMatch(/do-not-disclose|person@|13800000000|203\.0\.113\.10/);
|
|
});
|
|
|
|
it("allows explicit placeholders, environment interpolation and loopback addresses", () => {
|
|
const source = [
|
|
"SERVICE_PASSWORD=<managed-secret>",
|
|
"DATABASE_URL=${LOCAL_DATABASE_URL}",
|
|
"admin=<admin-email>",
|
|
"workspace=<repo-root>/server",
|
|
"server=127.0.0.1",
|
|
].join("\n");
|
|
|
|
expect(scanner.scanSensitiveText(source, "fixture.md")).toEqual([]);
|
|
});
|
|
|
|
it("derives current docs from the status matrix without pulling historical issue rows", () => {
|
|
const matrix = [
|
|
"| ID | Contract | Type | Purpose | Status |",
|
|
"| --- | --- | --- | --- | --- |",
|
|
"| `CURRENT-DOC` | `docs/current.md` | fact | current | `CURRENT` |",
|
|
"| `HISTORY-DOC` | `docs/history.md` | evidence | old | `EVIDENCE` |",
|
|
"| `CURRENT-ISSUE` | `issues/current.csv` | `CURRENT` | issue only |",
|
|
].join("\n");
|
|
|
|
expect(scanner.extractCurrentDocumentFiles(matrix)).toEqual(["docs/current.md"]);
|
|
});
|
|
|
|
it("includes every CURRENT docs contract in the default scan set", () => {
|
|
const files = scanner.resolveDefaultScanFiles(ROOT_DIR);
|
|
|
|
expect(files).toEqual(expect.arrayContaining([
|
|
"docs/测试规约与回归门禁.md",
|
|
"docs/需求-资产管理规约.md",
|
|
"docs/管理员手册.md",
|
|
"docs/员工快速上手.md",
|
|
]));
|
|
});
|
|
|
|
it("passes the registered current fact sources and deployment entrypoints", () => {
|
|
expect(scanner.scanSensitiveContent({ rootDir: ROOT_DIR })).toMatchObject({
|
|
status: "PASS",
|
|
findingCount: 0,
|
|
filesScanned: expect.any(Number),
|
|
findings: [],
|
|
});
|
|
});
|
|
});
|